Hcl EUVD-2025-209077

The risk profile shows significant disconnect between technical severity and practical exploitability. CVSS 2.6 with AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N indicates network-reachable impact, but exploitation requires login privileges, high attack complexity, and user interaction-substantially limiting attack surface. CISA SSVC decision framework assessment (Exploitation: none, Automatable: no, Technical Impact: partial) confirms no known active exploitation and that attacks cannot be fully automated, further reducing real-world priority. EPSS score is not provided in the input, but the combination of low CVSS, unauthenticated requirement, and lack of CISA KEV listing suggests this is a medium-to-low exploitation probability risk. The primary concern is not immediate compromise but rather the maintenance posture of the product-if Aftermarket DPC relies on decades-old libraries, the organization may lack incident response readiness or be vulnerable to future zero-day variants in those components.

An authenticated user (e.g., employee with valid credentials) is tricked via social engineering or phishing to visit a malicious webpage while their Aftermarket DPC session is active in the browser. The attacker's JavaScript leverages a known vulnerability in an outdated JavaScript library bundled with Aftermarket DPC to extract session tokens or sensitive configuration data from the user's browser context, leading to information disclosure. The requirement for user interaction (UI:R) and high attack complexity (AC:H) means this is not a direct server compromise but rather a client-side side-channel; widespread exploitation is unlikely without significant effort.